Periodic flow detection device, delay estimation device, periodic flow detection method and program

Abstract

Provided is a periodic flow detection device comprising: a packet classification unit that classifies acquired packets into a plurality of flows on the basis of information contained in the packets; a flow evaluation unit that evaluates, on the basis of the times at which the packets have been acquired, the possibility that each of the plurality of flows is periodically transmitted; and a flow detection unit that detects, on the basis of the evaluation result, a periodic flow to which a periodically acquired packet belongs from among the plurality of flows.

Description

[Technical field]

[0001] The present invention relates to a periodic flow detection device, a delay estimation device, a periodic flow detection method, and a program. [Background technology]

[0002] Services and applications such as VR and AR that require low latency and low jitter are appearing. In order to guarantee low latency and low jitter, it is important to measure the latency of packets sent and received in the network. Passive measurement is a method for measuring one-sided latency in a network, but it has the problem of needing to prepare clocks synchronized at multiple measurement points.

[0003] In response to this problem, a method of estimating delay using only a single clock has been proposed (for example, Non-Patent Document 1). FIG. 14 is a diagram showing a conventional technique for estimating delay using only a single clock. FIG. 14 shows RTP (Real-time Transport Protocol) packets (P1 to P4) transmitted from a transmitting side to a receiving side in VoIP (Voice over Internet Protocol). Here, the RTP packets are transmitted from the transmitting side to the receiving side at a constant time interval (ΔD). P1 is a packet received by the receiving side with zero queuing delay. P'2 to P'4 are hypothetical packets that would be received by the receiving side with zero queuing delay, similar to P1, for P2 to P4. Time interval ΔD i (i=2~4) is packet P i The time when the virtual packet P' was received i-1 The time interval between when the message was received and when the message was received.

[0004] At this time, the time interval ΔD i By calculating the difference between and ΔD, each packet P i The delay time can be calculated. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] B. Ngamwongwattana and R. Thompson, “Sync & Sense: VoIP Measurement Methodology for Assessing One-Way Delay Without Clock Synchronization,” IEEE TRANSACTIONS ON INSTRUMENTATION AND MEASUREMENT (2010) Summary of the Invention [Problem to be solved by the invention]

[0006] However, in the conventional technology shown in Fig. 14, the receiving side must also know the time interval ΔD at which packets are transmitted from the transmitting side. Therefore, when using an application other than VoIP, the transmission time interval ΔD may not be known, and it may not be possible to estimate the delay using the conventional technology. An object of the present invention is to provide a periodic flow detection device capable of detecting packets periodically transmitted from a transmitting side from a receiving side in order to estimate packet delay. [Means for solving the problem]

[0007] One aspect of the present invention is a periodic flow detection device that includes a packet classification unit that classifies acquired packets into multiple flows based on information contained in the packets, a flow evaluation unit that evaluates the possibility that each of the multiple flows is being transmitted periodically based on the time the packets were acquired, and a flow detection unit that detects a periodic flow from the multiple flows, which is a flow to which packets acquired periodically belong, based on the results of the evaluation.

[0008] One aspect of the present invention is a delay estimation device comprising a capture unit that acquires packets and records the time at which the packets were acquired, a periodic flow detection unit that detects a periodic flow to which a packet that is transmitted periodically belongs based on information contained in the packet, and a delay estimation unit that estimates a delay of the packet based on packets belonging to the periodic flow.

[0009] One aspect of the present invention is a periodic flow detection method comprising: a packet classification step of classifying acquired packets into a plurality of flows based on information contained in the packets; a flow evaluation step of evaluating the possibility that each of the plurality of flows is being transmitted periodically based on the time the packets were acquired; and a flow detection step of detecting, from the plurality of flows, a periodic flow to which a packet acquired periodically belongs based on the evaluation result.

[0010] One aspect of the present invention is a computer program for causing a computer to function as the above-described periodic flow detection device. Effect of the Invention

[0011] According to the present invention, when a plurality of applications are used, packets that are transmitted periodically can be detected. [Brief description of the drawings]

[0012] [Figure 1] 1 is a diagram illustrating a configuration of a communication system according to an embodiment. [Diagram 2] 2 is a schematic diagram showing packets transmitted in the communication system according to the embodiment; FIG. [Diagram 3] 1 is an example of a packet passing through a capture point. [Figure 4] 1 is a diagram illustrating a configuration of a delay estimation device according to an embodiment. [Diagram 5] 4 is a flowchart showing an operation of the delay estimation device according to the embodiment. [Figure 6]FIG. 4 is a diagram illustrating a configuration of a periodic flow detection unit according to the embodiment. [Figure 7] FIG. 2 is a diagram illustrating classified packets according to an embodiment. [Figure 8] 10 is a flowchart illustrating a method for calculating an evaluation value of a flow by a flow evaluation unit according to the embodiment. [Figure 9] 13 is an example showing a comparison between the maximum frequency of the frequency distribution of the acquisition time interval and a threshold value. [Figure 10] FIG. 13 is a diagram illustrating a method for calculating a threshold value according to the embodiment. [Figure 11] 10 is a flowchart illustrating a method for a flow detection unit to determine a periodic flow according to an embodiment. [Figure 12] FIG. 2 illustrates a method for identifying zero-delay packets according to an embodiment. [Figure 13] FIG. 2 illustrates a method for identifying zero-delay packets according to an embodiment. [Figure 14] FIG. 1 illustrates a prior art technique for estimating delay with only a single clock. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. <Overall structure> FIG. 1 is a diagram showing a configuration of a communication system 1. The communication system 1 comprises a user equipment 10, a first network 20, a capture point 30, a delay estimation device 40 and a second network 50.

[0014] The user equipment 10 is connected to a first network 20. The user equipment 10 transmits packets to the first network 20. The user equipment 10 may be anything that transmits packets. The user equipment 10 is, for example, a personal computer, an IoT sensor, a smartphone, or a server.

[0015] The first network 20 connects the user equipment 10 and the second network 50. The delay estimation device 40 acquires packets passing through the capture point 30 and estimates the delay of the packets based on the acquired packets. The delay estimation device 40 acquires packets by having a network device, such as a router, provided at the capture point 30 forward the packets passing through the capture point 30. The second network 50 is connected to the first network 20. The second network 50 may be further connected to other networks and devices.

[0016] The capture point 30 is a point indicating a position in a network where the delay estimation device 40 captures packets. The capture point 30 is provided between the first network 20 and the second network 50 in the communication system 1 shown in Fig. 1. Here, the delay estimation device 40 captures packets passing between the first network 20 and the second network 50, but is not limited to this. For example, the delay estimation device 40 may capture packets from a device such as a server that receives packets from the user device 10.

[0017] FIG. 2 is a schematic diagram showing packets transmitted in the communication system 1. As shown in FIG. The user equipment 10-1 transmits a packet 100-1 to the first network 20. The user equipment 10-2 transmits a packet 100-2 to the first network 20. The user equipment 10-3 transmits a packet 100-3 to the first network 20. There are three user equipments 10 in the communication system 1 shown in Fig. 2, but the number is not limited to this.

[0018] A packet 100 is transmitted from the first network 20 to the second network 50. The packet transmitted from the first network 20 to the second network 50 passes through the capture point 30. Fig. 3 shows an example of the packet 100 passing through the capture point 30. As shown in Fig. 3, a packet 100-1, a packet 100-2, and a packet 100-3 each having a different source user equipment 10 pass through the capture point 30.

[0019] Delay Estimation Device 40 FIG. 4 is a diagram showing a configuration of the delay estimation device 40. As shown in FIG. The delay estimation device 40 includes a capture unit 410 , a periodic flow detection unit 420 , a delay estimation unit 430 , and a packet acquisition time storage unit 440 .

[0020] The capture unit 410 captures packets that pass through the capture point 30 within a certain time. The capture unit 410 then associates the time at which the packet was captured with the packet, and records the packet and its capture time in the packet capture time memory unit 440. The packet capture time memory unit 440 stores the packets captured by the capture unit 410 within the certain time and their capture times. After the certain time has elapsed, the capture unit 410 transmits the packets and their capture times stored in the packet capture time memory unit 440 to the regular flow detection unit 420 and the delay estimation unit 430.

[0021] The periodic flow detection unit 420 classifies packets based on the information included in the packets received from the capture unit 410 and the acquisition time. Here, the packets are classified into a set called a "flow". Here, a flow indicates a group of packets that satisfy a predetermined condition. For example, a flow is a group of packets in which the contents of predetermined attribute information (all or part of the attribute information) included in the packets match. For example, a flow is a group of packets in which information included in the packets indicating the packet source and packet destination matches. Among the flows into which packets have been classified, the periodic flow detection unit 420 detects a periodic flow to which a packet that is transmitted periodically belongs. A method for detecting a periodic flow by the periodic flow detection unit 420 will be described later.

[0022] The delay estimation unit 430 estimates the delay of packets belonging to a regular flow based on the packets and reception times received from the capture unit 410. Furthermore, when the delay estimation unit 430 receives information about a regular flow from the regular flow detection unit 420, it changes the regular flow and estimates the delay of packets belonging to the changed regular flow. Details of the delay estimation unit 430 will be described later.

[0023] Flowchart of Delay Estimation Apparatus 5 is a flowchart showing the operation of the delay estimation device 40. First, the capture unit 410 captures packets that pass through the capture point 30 within a certain time (step S100). After that, the capture unit 410 transmits information contained in the captured packets and the capture time of the packets to the periodic flow detection unit 420 and the delay estimation unit 430 (step S200). The periodic flow detection unit 420 detects a periodic flow based on the received packets and the capture time (step S300). The delay estimation unit 430 estimates the delay of the periodic flow (step S400). The delay estimation device 40 estimates the delay of the periodic flow by repeating the operations from step S100 to step S400 at regular intervals. The series of operations from step S100 to step S400 repeated by the delay estimation device 40 is called a "cycle."

[0024] Periodic flow detection unit Here, we will explain in detail the functions of the periodic flow detection unit 420. Fig. 6 is a diagram showing the configuration of the periodic flow detection unit 420. The periodic flow detection unit 420 comprises a packet classification unit 421, a flow information recording unit 422, a flow evaluation unit 423, a flow determination unit 424, a flow information storage unit 425, a periodic flow threshold calculation unit 426, and a network probabilistic model storage unit 427.

[0025] The packet classification unit 421 classifies packets according to the flow to which the packets belong, based on the information included in the packets received from the capture unit 410 and the acquisition time. The packet classification unit 421 classifies packets according to the flow to which the packets belong, based on, for example, the 5-tuple or VLAN information included in the packets.

[0026] Fig. 7 is a diagram showing classified packets. Packets passing through the capture point 30 shown in Fig. 3 are classified by the packet classification unit 421 into flows to which the respective packets belong, for example, depending on the difference in the source of the packets.

[0027] The flow information recording unit 422 records information about the flow classified by the packet classification unit 421 in the flow information storage unit 425. The information about the flow is, for example, information about 5-tuple or VLAN that is used by the packet classification unit 421 to classify packets. The flow information storage unit 425 stores information about the flow into which the packets are classified every time the periodic flow detection unit 420 receives a packet and the acquisition time from the capture unit 410. In other words, by referring to the information stored in the flow information storage unit 425, the periodic flow detection unit 420 can know the flow to which the packet received in each cycle belongs. The information about the flow stored in the flow information storage unit 425 is used for the flow evaluation unit 423 to evaluate the flow.

[0028] The flow evaluation unit 423 evaluates the possibility that each flow is periodically transmitted. The flow evaluated by the flow evaluation unit 423 is a flow to which the packets classified by the packet classification unit 421 belong. The flow evaluation unit 423 calculates, for example, an evaluation value of the flow to which the packets acquired by the packet classification unit 421 belong. The larger the evaluation value, the higher the possibility that packets belonging to the flow are periodically transmitted. The flow evaluated by the flow evaluation unit 423 is called an evaluation flow. The flow evaluation unit 423 assigns an evaluation value to each of all flows to which packets received in the current cycle belong, in the manner described below.

[0029] 8 is a flowchart showing a method for calculating an evaluation value of a flow by the flow evaluation unit 423. The flow evaluation unit 423 determines whether or not the evaluation flow is a regular flow made up of packets acquired at a frequency equal to or higher than a predetermined frequency (step S301).

[0030] How to determine if a flow is regular The flow evaluation unit 423 determines whether the evaluation flow is a periodic flow or not by the following method. The flow evaluation unit 423 creates a frequency distribution of the acquisition time intervals of packets included in the evaluation flow. The flow evaluation unit 423 then compares the frequency of the most frequent value (maximum frequency) of the created frequency distribution with a predetermined threshold. The method of calculating the threshold will be described later. If the frequency of the most frequent value exceeds the predetermined threshold, the flow evaluation unit 423 determines that the evaluation flow is a periodic flow.

[0031] FIG. 9 is an example showing a comparison between the maximum frequency of the frequency distribution of the acquisition time interval and the threshold value. The comparison between the maximum frequency of the frequency distribution of the acquisition time interval and the threshold value will be explained using the frequency distribution of the acquisition time interval shown in FIG. 9, in which the horizontal axis is the acquisition time interval and the vertical axis is the frequency. FIG. 9 shows the frequency distribution for two different evaluation flows (F1 and F2). A predetermined value of the frequency is set as the threshold value. Since the maximum frequency of the evaluation flow F1 is higher than the threshold value, the corresponding evaluation flow is determined to be a periodic flow. Since the maximum frequency of the evaluation flow F2 is equal to or lower than the threshold value, the corresponding evaluation flow is determined to be not a periodic flow.

[0032] The threshold value that is the criterion for determining whether or not an evaluation flow is a periodic flow is calculated by the periodic flow threshold calculation unit 426 as follows, using the probability model stored in the network probability model storage unit 427. The probability model stored in the network probability model storage unit 427 is a probability model that describes the relationship between the time interval between packets transmitted from the user equipment 10 and the time interval between packets acquired by the capture unit 410. This probability model is, for example, a queue.

[0033] The periodic flow threshold calculation unit 426 calculates probability density functions P1 and P2 in which the maximum frequency of the time interval of packets passing through the capture point 30 is used as a random variable. Specifically, the periodic flow threshold calculation unit 426 calculates a probability density function P1 in which the maximum frequency of the frequency distribution created by the flow evaluation unit 423 is used as a random variable when it is assumed that packets are periodically transmitted from the user equipment 10 based on the probability model stored in the network probability model storage unit 427. In addition, the periodic flow threshold calculation unit 426 calculates a probability density function P2 in which the maximum frequency created by the flow evaluation unit 423 is used as a random variable when it is assumed that packets are periodically transmitted from the user equipment 10 with an allowable error based on the probability model stored in the network probability model storage unit 427.

[0034] After that, the periodic flow threshold calculation unit 426 sets the random variable (maximum frequency) when the values ​​of the functions P1 and P2 are equal as the threshold. Fig. 10 is a diagram showing a method for calculating the threshold. As shown in Fig. 10, when the horizontal axis represents the maximum frequency as a random variable and the vertical axis represents the frequency of the random variable, and functions P1 and P2 are plotted on a graph, the value of the random variable at the intersection of P1 and P2 becomes the threshold.

[0035] When the flow evaluation unit 423 determines that the evaluation flow is not a periodic flow (step S301: NO), it determines that packets belonging to the evaluation flow are not transmitted periodically and cannot be used for delay estimation, and calculates the evaluation value of the evaluation flow as 0 (step S303). When the flow evaluation unit 423 determines that the evaluation flow is a periodic flow (step S301: YES), it determines whether or not the evaluation flow is a continuous acquisition flow in which the capture unit 410 has acquired packets belonging to the evaluation flow since a predetermined time ago (step S302). For example, the flow evaluation unit 423 determines whether or not the evaluation flow is a continuous acquisition flow in which packets belonging to the evaluation flow have been acquired in all cycles since a predetermined time ago.

[0036] A method for determining whether an evaluation flow is a continuous acquisition flow is based on the evaluation flow and the flow information stored in the flow information storage unit 425. The flow information storage unit 425 stores a flow to which a packet acquired by the capture unit 410 in each cycle belongs. That is, the flow evaluation unit 423 can determine whether an evaluation flow is a flow to which a packet acquired by the capture unit 410 in each cycle belongs by referring to the flow information storage unit 425. That is, the flow evaluation unit 423 can determine whether the flow has been stored in the flow information storage unit 425 every cycle since a predetermined cycle before.

[0037] When the flow evaluation unit 423 determines that the evaluation flow is not a continuous acquisition flow (step S302: NO), it determines that packets belonging to the evaluation flow are not transmitted periodically, and calculates the evaluation value of the evaluation flow as 0 (step S303).When the flow evaluation unit 423 determines that the evaluation flow is a continuous acquisition flow (step S302: YES), it calculates the evaluation value v of the evaluation flow, for example, by equation (1) (step S304).

[0038]

number

[0039] In formula (1), σ is the standard deviation of the acquisition time intervals of packets included in the evaluation flow. Δ is the average acquisition time interval of packets belonging to the evaluation flow. In other words, the smaller the variation in packet acquisition time intervals and the smaller the average acquisition time interval, the larger the evaluation value v.

[0040] The flow determination unit 424 determines a periodic flow for delay estimation to be used by the delay estimation unit 430 based on the evaluation value of the flow calculated by the flow evaluation unit 423. FIG. 11 is a flowchart showing a method in which the flow determination unit 424 determines a periodic flow for delay estimation. First, the flow determination unit 424 determines a flow with a maximum evaluation value (hereinafter, the maximum evaluation value flow) from the evaluation values ​​calculated for each flow by the flow evaluation unit 423 (step S311). After that, the flow determination unit 424 judges whether the evaluation value of the maximum evaluation value flow is greater than a predetermined reference value (step S312). If the evaluation value of the maximum evaluation value flow is less than the reference value (step S312: NO), the flow determination unit 424 ends the operation. In other words, this means that the evaluation values ​​of all flows received in the current cycle do not reach the reference, and delay estimation is not performed in the current cycle.

[0041] If the evaluation value of the flow with the maximum evaluation value is greater than the reference value (step S312: YES), the flow determination unit 424 judges whether the evaluation value of the flow with the maximum evaluation value is greater than the evaluation value of the periodic flow for delay estimation (step S313). If the maximum evaluation value is equal to or less than the evaluation value of the periodic flow for delay estimation (step S313: NO), the flow determination unit 424 ends the operation. If the maximum evaluation value is equal to or less than the evaluation value of the periodic flow for delay estimation, this includes the case where the flow with the maximum evaluation value and the periodic flow for delay estimation are the same flow (i.e., the maximum evaluation value is equal to the evaluation value of the periodic flow for delay estimation). If the maximum evaluation value is greater than the evaluation value of the periodic flow for delay estimation (step S313: YES), the flow determination unit 424 transmits information about the flow with the maximum evaluation value to the delay estimation unit 430 (step S314). That is, the flow determination unit 424 determines that a new periodic flow for delay estimation has been detected in step S314. When the delay estimation unit 430 receives information about the maximum evaluation value flow from the flow determination unit 424, it changes the periodic flow for delay estimation to the received maximum evaluation value flow.

[0042] With the above configuration, the periodic flow detection unit 420 determines the periodic flow for delay estimation used by the delay estimation unit 430 .

[0043] Delay Estimation Unit The delay estimation unit 430 determines packets belonging to the periodic flow for delay estimation (hereinafter, periodic flow packets for delay estimation) and their acquisition times from the packets received from the capture unit 410 and their acquisition times, and performs delay estimation. Furthermore, when the delay estimation unit 430 receives information about the flow with the maximum evaluation value from the periodic flow detection unit 420, it changes the periodic flow for delay estimation to the received flow with the maximum evaluation value.

[0044] <Processing when changing the periodic flow for delay estimation> When changing the regular flow for delay estimation, the delay estimation unit 430 identifies a delay estimation reference packet that is a reference for delay estimation, and estimates the delay of the regular flow packet for delay estimation based on the transmission interval ΔD of the packet. The delay estimation reference packet is a packet that is estimated to have a small delay. FIG. 12 is a diagram showing a method for identifying a zero-delay packet. The delay estimation unit 430 calculates the transmission interval ΔD of the regular flow packet for delay estimation as the average value of the interval between the acquisition times of the received regular flow packets for delay estimation. Then, the delay estimation unit 430 plots the acquisition times of the regular flow packets for delay estimation on the vertical axis and the acquisition order on the horizontal axis. Then, the delay estimation unit 430 identifies two points among the two plotted points at which, when a straight line is drawn connecting the two points, the slope of the straight line is ΔD and the intercept of the straight line is the smallest. Then, the delay estimation unit 430 identifies the regular flow packet for delay estimation corresponding to the two points as the delay estimation reference packet. The delay estimation unit 430 estimates the delay of the delay estimation regular flow packet based on the calculated ΔD and the identified delay estimation reference packet.

[0045] The delay estimation unit 430 can also identify a delay estimation reference packet by another method, which will be described below. FIG. 13 is a diagram showing a method for identifying a delay estimation reference packet. As with the method shown in FIG. 12, the delay estimation unit 430 calculates the transmission interval ΔD of the regular flow packets for delay estimation as the average interval between the acquisition times of the received regular flow packets for delay estimation, and plots the acquisition times of the regular flow packets for delay estimation on the vertical axis and the acquisition order on the horizontal axis. After that, the delay estimation unit 430 draws a straight line (shown by a dotted line) with a slope of ΔD from the point corresponding to the first acquired regular flow packet for delay estimation, and calculates the difference from the plotted point. In other words, the acquisition time of the i-th acquired regular flow packet for delay estimation is taken as T i Then, the difference G i is calculated using equation (2).

[0046]

number

[0047] Then, the delay estimation unit 430 calculates the difference G i The delay estimation unit 430 identifies the regular flow packet for delay estimation having the smallest delay as the delay estimation reference packet. The delay estimation unit 430 estimates the delay of the regular flow packet for delay estimation based on ΔD and the delay estimation reference packet.

[0048] <Processing when the periodic flow for delay estimation is not changed> If the regular flow for delay estimation is not changed, the delay estimation unit 430 estimates the delay of the regular flow packet for delay estimation based on ΔD calculated previously and the identified delay estimation reference packet. Even if the regular flow for delay estimation is not changed, the delay estimation unit 430 may change ΔD and the delay estimation reference packet based on the received regular flow packet for delay estimation and the acquisition time.

[0049] Other Embodiments Although one embodiment of the present invention has been described in detail above with reference to the drawings, the specific configuration is not limited to the above, and various design changes, etc. are possible within the scope that does not deviate from the gist of the present invention.

[0050] The delay estimation device 40 includes a CPU (Central Processing Unit), a memory, an auxiliary storage device, and the like, which are connected by a bus, and functions as a delay estimation device including a capture unit 410, a periodic flow detection unit 420, and a delay estimation unit 430 by executing a program. All or part of the functions of the communication device may be realized using hardware such as an ASIC (Application Specific Integrated Circuit), a PLD (Programmable Logic Device), or an FPGA (Field Programmable Gate Array). The program may be recorded on a computer-readable recording medium. The computer-readable recording medium is, for example, a portable medium such as a flexible disk, a magneto-optical disk, a ROM, or a CD-ROM, or a storage device such as a hard disk built into a computer system. The program may be transmitted via an electric communication line. [Explanation of symbols]

[0051] 10 User equipment, 20 First network, 30 Capture point, 40 Delay estimation device, 50 Second network, 410 Capture unit, 420 Periodic flow detection unit, 430 Delay estimation unit, 440 Packet acquisition time storage unit, 421 Packet classification unit, 422 Flow information recording unit, 423 Flow evaluation unit, 424 Flow determination unit, 425 Flow information storage unit, 426 Periodic flow threshold calculation unit, 427 Network probability model storage unit

Claims

1. a packet classification unit that classifies the acquired packets into a plurality of flows based on information included in the packets; a flow evaluation unit that calculates an evaluation value indicating a possibility that each of the plurality of flows is periodically transmitted based on the time at which the packet is acquired; a flow determination unit that determines a flow having the largest evaluation value calculated from the plurality of flows as a delay estimation periodic flow, which is a flow to which a packet for which a delay is to be estimated belongs; A periodic flow detection device comprising:

2. the flow evaluation unit calculates the evaluation value based on an acquisition time interval of the packets; When the frequency of the most frequent value of the acquisition time interval of the packets is equal to or less than a predetermined threshold, the evaluation value is calculated as zero.

2. The periodic flow detection apparatus of claim 1.

3. the flow evaluation unit calculates the evaluation value as zero when a packet belonging to the flow is not a continuously acquired flow acquired before a predetermined time.

3. The periodic flow detector of claim 2.

4. The threshold value is a maximum frequency at which a probability density function in which the maximum frequency of an acquisition time interval when packets are periodically transmitted is used as a random variable and a probability density function in which the maximum frequency of an acquisition time interval when packets are periodically transmitted with an allowable error is used as a random variable are equal in frequency.

4. A periodic flow detector as claimed in claim 2 or 3.

5. When the flow evaluation unit does not calculate the evaluation value as zero, the flow evaluation unit calculates the evaluation value based on a standard deviation and an average value of an acquisition time interval of the packet. A periodic flow detector as claimed in any one of claims 2 to 4.

6. When the flow evaluation unit does not calculate the evaluation value as zero, the flow evaluation unit calculates the evaluation value as a reciprocal of a product of a standard deviation and an average value of an acquisition time interval of the packet.

6. The periodic flow detector of claim 5.

7. a capture unit that captures a packet and records the time when the packet was captured; a periodic flow detection unit that classifies the packets into a plurality of flows based on information included in the packets, calculates an evaluation value indicating the possibility that each of the plurality of flows is periodically transmitted based on the time at which the packets were acquired, and determines the flow with the largest calculated evaluation value from the plurality of flows as a periodic flow for delay estimation; a delay estimation unit that estimates a delay of the packets based on packets belonging to the delay estimation periodic flow; A delay estimator comprising:

8. the delay estimation unit identifies at least one packet belonging to the delay estimation periodic flow as a delay estimation reference packet that is a packet serving as a reference for delay estimation; estimating a delay of the packet based on the delay estimation reference packet; The delay estimator according to claim 7.

9. a packet classification step of classifying the acquired packets into a plurality of flows based on information contained in the packets; a flow evaluation step of calculating an evaluation value indicating a possibility that each of the plurality of flows is periodically transmitted based on the time at which the packet was acquired; a flow determination step of determining a flow having the largest evaluation value calculated from the plurality of flows as a periodic flow for delay estimation, the flow being a flow to which a packet for which a delay is to be estimated belongs; A periodic flow detection method having the following steps.

10. A computer program for causing a computer to function as the periodic flow detection device according to any one of claims 1 to 6.

Images